The FCA’s 5 + 5 Day Sanctions Test: Would Your Firm Survive?

Last year, the FCA carried out a review of building societies, platforms, custody and fund services and payments and wealth management firms in the UK to evaluate their business-wide sanctions risk assessment (BWRA) and customer risk assessment (CRA) processes. Its aim was to understand how firms identify, assess, and appropriately mitigate risk, and to effectively manage it. 

The Authority’s findings demonstrate that it’s no longer enough to simply have a sanctions policy in place; instead, reveal the importance of firms being able to prove, under considerable pressure (possibly with only five days’ notice), that the framework they do have works in practice. We examine the importance of good practice in addressing this issue.

A subtle but significant shift

How regulators engage with firms on sanctions is becoming increasingly structured, operational, and technically informed. Supervisory requests are no longer confined to high-level policy reviews but affect every department and level of seniority.

Firms are being asked to widen the scope of their sanctions policies and demonstrate that they have:

• A clear understanding of their potential exposure to sanctions
• Evidence of how effective their screening and escalation processes are
• Meaningful oversight at the senior management level
• Real-time operational controls.

This combination of obligations is necessary to demonstrate to the regulator that firms’ controls are effective, not simply statements of intent.

Why this matters for the London Insurance Market

Sanctions exposure has become increasingly complex over recent years and brokers, insurers, managing agents and coverholders must deal with complex distribution chains, delegated authority arrangements, cross-border premium flows and sector-specific risks, which create added layers that must be navigated effectively and efficiently.

However, with that complexity, expectations are also heightened and regulators now expect firms to be able to articulate, quantify and defend their exposure in a confident and coherent manner.

Inspection-ready compliance

Many firms may think that they are compliant because they:

• Already have a sanctions policy
• Use a recognised screening tool
• Submit regulatory reports on time
• Have not suffered a significant breach.

However, there is a vast difference between being apparently compliant and being inspection-ready. If and when they become subject to scrutiny, which often arrives with little notice, firms must ensure that they already have:

• Clear governance ownership
• A documented rationale to explain control decisions
• Reliable and clear management information
• Hard evidence that senior leaders understand the framework.

The moment that firms need to assemble or explain their documentation under the tight timeframe pressure of an inspection, their risk profile is immediately raised.

A question of leadership

Sanctions compliance has now shifted from being a purely operational issue into a governance one. It’s important, therefore, that boards and senior management establish the following:

• Could they unhesitatingly explain their sanctions exposure to a regulator?
• Do they have confidence in how their controls are calibrated and overseen?
• Does their MI offer genuine insight or is it simply data-heavy?
• Could they respond effectively if notified of an inspection in five days’ time?

These questions raise strategic, not technical, issues and echo the FCA’s findings that few firms are identifying relevant risks sufficiently.

This can lead to an inability to demonstrate control effectiveness when challenged, creating vulnerability. It’s only when firms apply supervisory scrutiny successfully that clarity, ownership, auditability and resilience can be tested properly and firms that treat sanctions as a static compliance obligation may well find themselves woefully unprepared if they are subject to a dynamic regulatory review.

Staying ahead of scrutiny

Sanctions requirements will continue to evolve rapidly in response to global events and ever more sophisticated cybercrime, and the FCA, in particular, already expects firms to comply with existing requirements in parallel with this evolution.

If they wish to remain confident under scrutiny, firms must:

• Treat sanctions as an enterprise risk
• Regularly review and challenge their frameworks
• Ensure that governance is active, not passive
• Embed accountability into all departments.

Firms must be prepared for the potential of a short-notice audit, and that means taking deliberate and considered actions to avoid poor practice.

How Brighter can help

We work with London Market firms to enhance sanctions governance and operational readiness through pragmatic, discreet and commercially focused measures. We have previously helped organisations to:

• Clarify and articulate their sanctions exposure
• Strengthen their governance and oversight structures
• Assess the robustness of their operational controls and tools
• Confidently prepare for supervisory engagement.

We have also supported high-profile London Market clients through recent FCA Sanctions Audits which gives us first-hand experience of what firms can expect and what’s required of them in such situations. Our objective is to enable them to withstand scrutiny through a credible and assured approach so that they can not only survive a 5 + 5 Day Sanctions test but come through unscathed and even improved.